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<N ■ 

bJO' Quantum computers are known to be qualitatively more powerful than classical computers, 

. but so far only a small number of different algorithms have been discovered that actually 

■ use this potential. It would therefore be highly desirable to develop other types of quantum 

algorithms that widen the range of possible applications. Here we propose an efficient and 
deterministic quantum algorithm for finding the square- free part of a large integer - a problem 
for which no efficient classical algorithm exists. The algorithm relies on properties of Gauss 



Oh' 



^ ■ sums and uses the quantum Fourier transform. We give an explicit quantum network for the 

^ ■ algorithm. Our algorithm introduces new concepts and methods that have not been used in 



X 



quantum information processing so far and may be applicable to a wider class of problems. 



> 

QQ ■ A fundamental tenet of classical computer science is based on the Church- Turing thesis, which 

. asserts that any practically realizable computational device can be simulated by a universal com- 

od _ 

^ . classical physics [2] and was challenged by Feynman [3] and others who suggested that compu- 



puter known as the Turing machine [1]. However, this hypothesis implicitly relies on the laws of 



tational devices behaving according to quantum mechanics could be qualitatively more powerful 
than classical computers. A first proof of this conjecture was given in 1993 by Bernstein and 



^ ■ Vazirani [4]. They showed that a quantum mechanical Turing machine is capable of simulating 

other quantum mechanical systems in polynomial time, an exponential improvement in computa- 
tional power over the classical Turing machine. Their proof did not give an actual fast quantum 
algorithm, but in the following year, Peter Shor came up with his famous factoring algorithm [5], 
which solves the integer factorization problem in polynomial time, exponentially faster than any 
known classical algorithms. The essential part of this algorithm is a solution of the order-finding 
problem, which can be formulated as a hidden subgroup problem (HSP) [6]. A hidden subgroup 
problem is like to find out the period of a given periodic function. The structure of the function's 
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periodicity may be so complicated that it can not be easily determined by classical means. The 
importance of the HSP is that various instances (eg. Pell's equation, the principal ideal problem, 
unit group computing) and variants like the hidden shift problem and hidden nonlinear structures 
encompass most of the quantum algorithms found so far that are exponentially faster than their 
classical counterparts [7]. This relatively narrow range of existing fast quantum algorithms shows 
the urgent need for different types of quantum algorithms that will make other classes of problems 
accessible to efficient solutions. 

Here we describe such a quantum algorithm that does not fall into the framework of HSP. It 
solves two number-theoretical problems in polynomial time, i.e., testing the square- freeness and 
computing the square- free part of a given integer. Compared to the known classical algorithms, 
this provides an exponential increase in computational efficiency. While these problems are related 
to the factorization problem solved by Shor, our algorithm relies on a different approach. Further- 
more, while Shor's algorithm is probabilistic, the algorithm presented here is deterministic and its 
computational complexity is lower. 

We consider a positive integer N with its unique prime factor decomposition N = Pi^P2^ • • • p^^ 
{pi are primes). N is called square- free if no prime factor occurs more than once, i.e., for all i 
(i = 1, 2, A:), ai = OT 1. An arbitrary positive integer can always be written as 

A^ = r•5^ (1) 

where r is square-free, and this square-free decomposition is unique. Thus, usually r and 5^ are 
called the square-free part and the square part of respectively. The square-freeness testing 
problem corresponds to determining whether 5 = 1. An additional problem consists in finding 
the square-free part r of N. These problems were listed as two unsolved open problems [8], since 
no efficient algorithm is currently known for either of them. Actually they may be no easier 
than the general problem of integer factorization [9]. It was found [10] that the factorization of 
N = pq^ (p, q both prime) is almost as hard as the factorization of = pq. This fact has been 
used in a proposed digital signature scheme called TSH-ESIGN, which is more efficient than any 
representative signature scheme such as elliptic curve and RSA based signature [10]. On the other 
hand, the square-free part problem appears to be a representative of a larger class of computational 
problems. As an example, computing the ring of integers of an algebraic number field, one of the 
main tasks of computational algebraic number theory, reduces to it in deterministic polynomial 
time [11, 12]. 

We now describe an efficient, deterministic quantum algorithm that solves both problems. It 
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uses the Gauss sum, an important object which has been extensively investigated in mathematics 
(see supplementary information). Throughout this paper, we will assume that N is an odd integer 
(the case of even numbers can be trivially reduced to this case). The Gauss sum is defined as 

N-l 



G{a,x) = ^ XN{m)e 



2Tzia'm/N 

m=0 



where a is an integer and the function Xa^(^) represents the Jacobi symbol of m relative to N [13]. 

The evaluation of the Gauss sum is closely related to the square-freeness of N . Let notation 
(x, y) indicate the greatest common divider (GCD) of x and y. If N is square-free, then we have 

G(a,x) = 0, V(a,iV)>l. (2) 

Conversely [14], if N is not square- free 

G(a,x) = 0, V(a,Ar) = l. (3) 

This remarkable fact suggests a dichotomy criterion for testing square-freeness, it represents the 
cornerstone of our algorithm. 

We present the algorithm first for the relatively simple case where N — pq^ (p^ q both prime) 
and subsequently generalize it. The algorithm consists of two parts, as illustrated in Fig. 1. In the 
first part, we generate the state 

l'^) = ^4^ E x{ni,N)\m), (4) 

where the normalization coefficient (p{N) represents Euler's function (number of integers smaller 
than N that are coprime to N). van Dam and Seroussi [15] proposed a general method for preparing 
such a superposition state. They gave the example of computing the Legendre symbol, which is a 
special case of the Jacobi symbol, which reduces to the Legendre symbol when N is prime. They 
also computed the Jacobi symbol for the case when the factorization of N is known. In our case, 
the factors of N are not known. Thus we would adopt another technique for computing the Jaocbi 
symbol [16], which we discuss in the following. The second part of the algorithm is to apply the 
quantum Fourier transform (QFT) to 10). The resulting state encodes the factors p and q of N, 
which can be retrieved by performing measurements on the qubits. 

Now we discuss the details of the algorithm. Set n = [log , the smallest integer for which 
2^ > N. We need two main registers A and both initialized to |0)*^^. Additional registers 
needed for storing auxiliary variables and constants are not represented explicitly for simplicity. 
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FIG. 1: Outline of quantum circuit for computing the square- free part for TV = pq^ , The procedure 
denoted as Vt in the text consists of two main parts. In the first part, we generate the state in the second 
part, we apply the quantum Fourier transform (QFT) to it. Single lines represent qubits, and boxes represent 
operations. Time runs from left to right. The transformation Ui and U2 are defined by Eq. (5) and Eq. (6). 
The meters Mi and M2 represent the measurements. The double lines coming from Mi carry the classical 
bits, here the algorithm continues only if register B collapses to 1. 



The first part starts with a state uniformly superposed from 1 to — 1, which is prepared just by 
an — 1 dimensional Fourier transform on register A and a subsequent addition with 1 

1 ^"^ 



m=l 



Note that this Fourier transform is of order — 1, and it was known [17] that the quantum fast 
Fourier transform can be made exact for arbitrary orders. Next we compute the greatest common 
divisor of m and N into register B 

N-l N-l 

^1 ■ E \^)a I0)r ^ E (5) 

m=l 171=1 

Classically, the GCD problem can be efficiently solved by the classical Euclidean algorithm in 
quadratic polynomial time. In order not to involve the complicated division arithmetics of the 
Euclidean algorithm, we prefer to adopt the extended Euclidean algorithm [18]. The extended 
Euclidean algorithm can be directly generalized to a quantum GCD algorithm that operates on a 
superposition state with the same computational complexity (see supplementary information for 
the quantum network construction). 

We then take a measurement Mi of register B. If the result is not 1, then it must hep ot q or q^ 
and clearly the algorithm already succeeds. However, it's highly possible that we would not obtain 
such results, and the algorithm continues. This is because the probability of obtaining (m, A^) = 1 
is (p{N)/{N — 1) = — 1)(^ — ~ 1)5 which asymptotically approaches 1 for sufficiently large 

p and q. If Mi results in 1, we get 

1 



J2 



{m,N)=l 



The next step is to obtain the state \<j)) as given in (4), i.e., we do the fohowing unitary operation 
on register A 



where x(^) ^"^^ 1 or —1 as by the definition of Jacobi symbol, and register B is omitted. The 
key part of U2 is to compute the Jacobi symbol x(^) foi" ^) = 1- Classically, the Jacobi 

symbol can be efficiently solved by many algorithms. There exists [19] a binary algorithm which 
has the advantage of lower complexity and easier implementation on a binary computer. The 
binary algorithm can be seen as a variant of the extended Euclidean algorithm, and hence can also 
be extended to a quantum algorithm (see supplementary information for the quantum network 
construction) . 

As the last step of the algorithm, we take a Fourier transform on and obtain 



According to the properties (2) and (3) of the Gauss sum, all amplitudes vanish unless k shares 
a nontrivial common factor with N . If we perform a measurement M2 on the register, it always 
collapses to a state |A:o), whose GCD with is a non-trivial factor p ot q oi N. It therefore yields 
the complete decomposition of A^. 

We now determine the computational complexity of this algorithm. All the transformations 
involved in the algorithm, including the extended Euclidean algorithm for GCD and Jacobi symbol 
and QFT, require 0((logA^)^) elementary gate operations [6]. Thus this algorithm has only a 
polynomial-time complexity. 

For a general A^ with possibly many distinct prime factors (square- freeness of A^ is unknown), 
the procedure outlined above may not work. However, it can be generalized to include this case, 
and the generalized algorithm remains simple and efficient. We refer to the algorithm described 
above as and discuss now the generalized algorithm, which includes as a subroutine. 

As we discussed, the algorithm includes two measurements. Mi and M2. With a certain 
probability. Mi yields a nontrivial factor of A^. If this does not happen, we proceed to the second 
measurement M2. Two possibilities will occur at M2 due to the dichotomy property of Gauss sum 
(2, 3) : we obtain (z) a non-trivial factor of A^ if A^ is not square-free, or (ii) a result coprime 




(6) 





N-1 



(7) 
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Q 



// ix,N)=\ 



compute d=(c,N/c) 



If ix,N)=c>\ 

c/d 




N/cd 



N is square-free 




FIG. 2: Schematic flow chart of the recursive quantum algorithm for computing the squrare- 
free part of an arbitrary odd integer TV. a, Possible outcomes of applying the algorithm on an 
arbitrary odd integer N: either return a factor c or else ensure that is a square- free number with the 
square-free part r = N. If a factor c > 1 is returned, and N is tested to be not square-free, then the problem 
is converted to two smaller subproblems for c/d and N/cd where d is the greatest common divisor of c and 
N/c. This serves as the subroutine of the recursive quantum algorithm, b. Recursive algorithm for a general 
N. Different colors are used to designate two different outcomes after applying the subroutine Q. The red 
color denotes that number is square-free, then this branch terminates. The blue color denotes the other 
outcome; in this case, the algorithm proceeds to the next step of recursion. The Q operation needs to be 
performed at most log N times to solve this problem. 



to N, which signifies that N is definitely square-free. As a result, no matter whether ends at 
Ml or M2, it either yields a non-trivial factor (say c) of N or determines that N is square- free. 
In the latter case, we have succeeded already, hence the algorithm finishes. In the former case, if 
the two parts c and N/c share a common factor d = {c,N/c), we know that d^ is a factor of the 
square part 5^ of N. We thus can split the problem of finding the square-free part r of into 
two smaller problems: finding the square- free parts of c/d and N/{cd). From the solutions of these 
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subproblems, we find the corresponding parts of as 

r = R(N) = R[c/d) ' R{N/cd) 

(8) 

= S{N) = S{c/d) • S{N/cd) • d^. 

Here, and S{') represent the square- free part and the square part of their argument, re- 

spectively. Clearly, this procedure can be iterated until all branches have determined that the 
arguments are square-free. Figure 2 illustrates this recursive procedure. 

The execution time of the extended algorithm reaches a maximum when each execution of 
yields just one factor, but clearly, the number of repetitions is still bounded by O(logA^). Each 
execution of the subroutine requires at most 0((logA^)^) steps. The worst-case complexity of 
the extended algorithm is therefore 0((logA^)^). Actually, we have a better estimation of how 
long it takes untill the algorithm succeeds. This is by virtue of the observation that M2 yields the 
square part with high probability, and calculations show that the algorithm will finish with high 
probability in just 0((log A^)^(log log A^)^) (see methods). 

Classically, finding the square-free part of an integer is known to be hard. It was argued [10] that 
the best method known for its solution is through factorization. The fastest classical algorithm for 
factorization would be the number field sieve [20], which requires 0(exp(c(log Nfl^ {\og log Nfl^)) 
steps. Thus the quantum algorithm presented here offers an exponential speed-up over the classi- 
cal algorithm. A feasible alternative to our algorithm would be to use Shor's algorithm to obtain 
the complete decomposition of N also in polynomial time. Application of Shor's algorithm yields, 
with some probability, two divisors of N in time O ( (log A^)^ log log log log log A^) [6]. Like our 
algorithm, Shor's algorithm would thus also be applied repetitively, with the number of iterations 
bounded by O(logA^). The overall computational complexity using Shor's algorithm would be 
0((log A^)^ loglog A^logloglog A^). Figure 3 compares the computational costs of the three algo- 
rithms described above, clearly showing the increase in computational efficiency by the algorithm 
presented here. 

Our algorithm relies on the mathematical properties of the Gauss sums. The possibility of using 
the periodicity properties of Gauss sums for factorization was suggested earlier [21, 22] and the 
feasibility of this approach was demonstrated in various physical systems including nuclear mag- 
netic resoance [23-25], cold atoms [26] and superconducting circuits [27]. However, these schemes 
did not use the specific properties of quantum mechanical systems. They can be implemented in 
classical as well as in quantum systems and the scaling properties are therefore not superior to 
other classical algorithms. In contrast, the algorithm that we have described in this paper relies 
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1,000 2,000 

Number of digits 



FIG. 3: Comparison between the computational costs of the three algorithms discussed in the 
text. Both quantum algorithms offer exponential speedup over the classical methods. For hundreds of 
digits, our algorithm is almost two orders of magnitude faster than the Shor's algorithm. 

on quantum superpositions and is both efficient and deterministic in solving the square-free part 
computation problem, even demonstrates advantages over Shor's approach. In Shor's algorithm, 
the major cost comes from the modular exponentiation operation, while Gauss sums can be gener- 
ated through 0((log A^)^) modular square operation. In our algorithm, we have noticed that Gauss 
sum evaluations are closely related to the factorization of N. While we have not found such an 
algorithm so far, it may thus be possible to develop a quantum algorithm on the basis of Gauss 
sums that solves integer factorization. 
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Methods 

A. Realization of Ui. 

Ui is to compute the greatest common divisor of m and N. Classically, the GCD problem 
can be efficiently solved based on the famous extended Euclidean algorithm. There is a variant 
of this algorithm, called the binary GCD algorithm, which can be more conveniently performed 
on a binary computer. We adopt this method here, and succeed in finding a quantum network 
that performs the binary GCD algorithm on a quantum superposition state (see supplementary 
information for details). 

B. Realization of 1/2- 

In Fig. 1, the operation U2 is realized through the following steps 

(0) . ^ |m)^|l)^ initial state 

{m,N)=l 

(1) . Yl \^)a\x{^))b ^PPly the operation of Jacobi symbol computation 

{m,N)=l 

(2) . Yl e^^*^^(^)~-'^)/^|m)^|x(^))^ apply conditional phase shifts 

{m,N)=l 

(3) - ^ Y x{^)\^) a\^) B ^PPly step (1) in reverse order 

(m,N)=l 

(4) . = |</.)^|1)b, 

where we use the phase kickback trick [15] and the identity e^^^^^^^"-*^)/^ = x(^)- The computation 
of Jacobi symbol can be implemented by binary Jaocbi algorithm (see supplementary information 
for details). 

C. Complexity estimation of the algorithm. 

In the following, we discuss the algorithm complexity for a general case N. To do this, we 
slightly change the algorithm presented in the text. Our analysis is based on the finding: if at the 
measurement M2 we obtain a result whose common divisor with is a square number, then the 
common divisor must be the square part 5^ of N; and the probability of this case is larger than 
((f(N)/N)'^ (see supplementary information for proofs). Hence the algorithm can be altered in the 
way that if any branch of the algorithm proceeds to M2 and results in a square number, then that 
branch terminates. 
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Denote P(-) as the probability of obtaining the square part of its argument by apphcation of 
Let pk denotes the probabihty that the algorithm succeeds at the k-th iteration step. Obviously 

Pi = P{N), 

where P{N) > (ip(N)/N)'^ . If Q does not succeed at the first step, and suppose we have obtained 
c and N/c and d = (c, N/c), then 

p^ = {l-P{N))p(^)p(-^ 



dJ \cd^ 
^ ^^V c/d N/cd J 

>(i-PW)(^)' 
= (1-P(N))P{N). 

Here, the second inequality is valid because of a basic property of the Euler function 

gcd(m,n) 

(p{mn) = (p{m)tf{n) --. 

¥?(gcd(m,n)) 

Analogously, we will have 

P3 > (1 - P{N)fP{N) 



Pk>{l-P{N))''-^P{N). 
Therefore, after k steps, the probability that the algorithm still does not succeed is 

k / / \ 2\ ^ 

Q < 1 - J] (1 - P{N)y-'P{N) = (1 - P{N))>' <ll- j . 

According to the inequality (Theorem 8.8.7 [28]) 

^{N) ^ 1 



N e7 log log AT +13^ 
where 7 = 0.5772... is the Euler-Mascheroni constant, and for a large (p{N)/N > 1/(2 log log A^). 
So we have 



When k = 0((log log A^)^), Q 0, this means, the algorithm doesn't need to go for k = O(logA^) 
times, but would finish with high probability in 0((log log A^)^) steps. 
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Supplementary Information: An Efficient Deterministic Quantum Algorithm for the Integer 

Square-free Decomposition Problem 
Jun Li, Xinhua Peng, Jiangfeng Du, Dieter Suter 

Gauss sum evaluation 

In the Gauss sum 

N-l 

the Jacobi symbol Xn{t^) is defined in terms of the Legendre symbols XpA^) with respect to the 
prime factors of N 

XN{m) = XpMT'Xp,{mr' ■ ■ ■ Xp.irnr'- (H) 

Here, the Legendre symbol Xpii^) ^ prime number pi is 

z/m = O(modj)^); 

Xpi{m) — ^ +1 if m ^ O(modp^) andm = x^(modp^)for some integer x; (12) 
— 1 otherwise. 

If N is square-free, the Jacobi symbol is a primitive Dirichlet character modN. As shown in 
ref. [14], the Gauss sum then has the following important properties 

G{a,x)^SNX{a)VN. (13) 

If, in addition, (a, A^) > 1, by definition of the Jacobi symbol we'll have 

G{a,x) = 0. (14) 

The general formula for the case that N is not square-free can be found in ref. [14] (p94. 
Exercise 12). Here, we only need the special case where {a,N) = 1. Then, the general formula 
evaluates to 

G(a,x) = 0. (15) 

Quantum Network for Extended Euclidean Algorithm 

In the main paper and methods, we point out that Ui (greatest common divisor computation) 

N-l N-l 

1^) \N)^ — Y, H \{^,N)), (16) 



m=U m=U 



and the key part of U2 (Jacobi symbol computation) 



1 



1 



E \m)\x{m)). 



(17) 



(m,N)=l 



{rn,N)=l 



can be efficiently solved based on the famous extended Euclid algorithm. There is a variant of this 
algorithm, called the binary extended Euclidean algorithm [28], which can be more conveniently 
performed on a binary computer. The classical binary algorithms for GCD and Jacobi symbol are 
presented in supplementary Fig. 1 and supplementary Fig. 2 respectively. 

We now try to construct a quantum version of the binary algorithms. The classical algorithm 
contains several conditional statements that translate into conditional control operations in the 
quantum algorithm. For some of them auxiliary registers are needed. Take binary GCD algorithm 
for example, corresponding to the conditional statements in supplementary Fig. 1, we add three 
additional registers called "terminate or go on control register" (statement 7), "even or odd control 
register" (statement 8, 9) and "comparison control register" (statement 10). The three kinds of 
registers function as (1) "terminate or go on": ^ = and 1 ^ > 0; (2) "even or odd": 
^ odd and 1 ^ even] (3) "comparison": {) u < v and 1 ^ u> v respectively. As illustrated in 
supplementary Fig. 3, the complete algorithm requires seven registers. Details of the construction 
are illustrated in supplementary Fig. 5. Like in the classical case, the quantum circuit complexity 
for the GCD problem is of the order of 0((log A^)^). 

Analogously, the quantum network for Jacobi symbol computation can be constructed. Note 
that the conditional statements 5, 9, 12 in supplementary Fig. 2 are easy to implement, because 
the modular properties of u and v with respect to 4 and 8 are only determined by their lowest 
digits. Besides, in the network, if x(^) = — 1, we represent it by r = A^ — 1. The explicit network 
for Jacobi symbol computation is illustrated in supplementary Fig. 4 and supplementary Fig. 6. 



In the complexity estimation of the algorithm (see methods), we made two arguments 

1. for an odd integer A^, if proceeds to M2 with measurement result o and (o, A^) is a square 
number, then (o, A^) must be the square part of A^; 

2. for an odd integer A^, application of will directly yield the square part of A^ with probability 
larger than {Lp{N)/Nf. 

Now we explain why the above arguments are valid. 



Complexity estimation of the algorithm 
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1. Proof of argument 1 

We now prove that at measurement M2, if (o, A^) is a square number z^, then it must be equal 
to s^. To prove this, set o = tz^ and N = xz^. 

We need to evaluate G{tz^^x)- First it is rewritten as 

N-l 

G{tz^,X) = x{m)e^^'''^'^'^ = ^ x{m)e^^'''^''' . (18) 

m=0 (m,A^)=l 

Let m = kx + j, where < A; < — 1 and < j < x — 1 such that (fcx + j, A^) = 1. As 

Xikx + j) = = = xAj), (19) 

\ XZ^ J \ X J 

there is 

G{tz\x)^ J2 (xx(i)e2-*^>- 5] 1). (20) 

{j,N)=l \ {kx+j,N)=l J 

E 1- E 1 

G(^.^x) = ^Ex.(j)e^-*^> = ^G(t,x.). (22) 

According to the Gauss sum formula, G{tz^,x) 7^ if and only if x is square-free. Then as the 
square-free decomposition is unique, x must be r and must be s^. 



Since for a certain j 



hence 



2. Proof of argument 2 

For o — ts^ and (t, A'^) = 1, we then have 

G{ts\ X) = ^ E X.(j)e^-*^-/^ = x(^)^.^/^^. (23) 

Now it is obvious that the probability of obtaining o such that o = ts^ and (t, A) = 1 is 

Y.(^t,N)=i\G{ts\xt ^ ^{r)r^\N) ^ ^{N)r 

<f{N)N (p{N)N<f'^{r) N<f{r)' ^ ' 

As the probability that the algorithm not terminate at measurement M\ is {ip{N)/N), the proba- 
bility that the algorithm proceeds to measurement M2 and gives the square part would be 
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Algorithm - binary GCD algorithm. 



Input: A/and/T7. 

Output: r, such that r=(m, N). 



1. 


Set u=N, v=m, r=l; 


2. 


While (u is even) and (v is even) do { 


3. 


u=u/2; 


4. 


v=v/2; 


5. 


r=2r; 


6. 


} 


7. 


While v;^0 do{ 


8. 


while (u is even) do u=u/2; 


9. 


while (v is even) do v=v/2; 


10. 


if u>v then u=(u-v)/2; 


11. 


else v=(v-u)/2; 


12. 


} 


13. 


r=u ■ r; 


14. 


Return r. 



Supplementary Figure SI: Classical binary algorithm for computing GCD. 



Algorithm - binary Jaocbi symbol algorithm. 



Input: A/ and m. A/ is odd, {/T7,A/)=1. 
Output: r, such that r=XN(nn). 



1. Set u=N, v=m, r=l; 

2. While tv ;^ 1 do { 

3. While V is even do { 

4. v=v/2; 

5. if (u mod 8=3) or (u mod 8=5) then r=-r; 

6. } 

7. if \/<L/{ 

8. swap {t/,\/); 

9. if (v mod 4=3) and (tv mod 4=3) then r=-r; 

10. } 

11. v={v-u)/2; 

12. if (u mod 8=3) or (tv mod 8=5) then r=-r; 

13. } 

14. Return r. 



Supplementary Figure S2: Classical binary algorithm for computing Jacobi symbol. 
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Supplementary Figure S3: Outline of the circuit for binary GCD algorithm. This represents the 
quantum generahzation of the classical binary GCD algorithm. Each horizontal line represents a quantum 
register with n qubits. The first three lines labeled r represent the corresponding variables from the 
classical algorithm, as represented in supplementary Fig. 1. 
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Supplementary Figure S4: Outline of the circuit for binary Jacobi symbol algorithm. This 
represents the quantum generalization of the classical binary Jacobi symbol algorithm. Each horizontal line 
represents a quantum register with n qubits. The first three lines labeled r represent the corresponding 
variables from the classical algorithm, as represented in supplementary Fig. 2. 
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Supplementary Figure S5: Quantum circuit for binary GCD algorithm. The circuit is obtained 
through complete translation from the classical binary GCD algorithm. 
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Supplementary Figure S6: Quantum circuit for binary Jacobi symbol algorithm. The circuit is 
obtained through complete translation from the classical binary Jacobi symbol algorithm. 



